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Purpose 


The Log Interface may be used by Galleon system components to record messages about system 
activity. 

The interface provides standards for how logs should be generated, formatted, and reported to the 
system. 

Design 


The Log Interface is designed to allow Galleon system components to contribute log messages to a 
system-wide log. The interface specifies that a system should use Syslog for logging and provides 
conventions for its use. 

Syslog 

Syslog is a standard for computer logging that isolates software that generates log messages from those 
that store and analyze them. Syslog has been standardized by the Internet Engineering Task Force (IETF) 
in RFC 5424. 

Syslog messages are composed of three parts: priority, header, and message. 

The priority field is a number that defines the facility and severity of the message. The severity records 
the message's urgency and is stored in the three least significant bits. The facility is stored in the next 
five significant bits and records the type of program that generated the message. 

The header field is composed of the timestamp when the log was generated and the hostname or IP 
address of the machine that generated it. 

The message field is composed of a tag and content field. The tag is typically used to record the name of 
the program or subsystem that generated the message. 

Message Tag 

Galleon system components should use the tag subfield of the Syslog message field to report a unique 
name for their component. 

On most Syslog implementations, the Tag field is set by providing an ident argument to openiog ( ) 
before generating log messages. By default, the basename of argv[0] is used. 

Facility 

Galleon system components should use the predefined facility value most appropriate for their 
program. The Log Interface does not define any meaning for the "Local Use" facility values. 

Components that run as daemons should use the log_daemon (3) facility. Components that are not long 
running (CLI tools, CGI programs) should use the log_user (i) facility. 

Severity 

Galleon system components should use the severity level most appropriate for any given message. 
Severity represents the urgency with which the message should be delivered to a system user. 
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Syslog defines the following severity levels: 

0 emergency System is unusable, compromised 

1 alert Emergency is imminent 

2 critical Errors that may cause a loss of data 

3 error Errors that do not cause data loss, may introduce unexpected behavior 

4\ warning Errors may occur if action is not taken 

5 notice Normal but significant events 

6 information Normal events 

V debug Debug information 


Implementation 


Configuration 

A system implementing the Log Interface should define the following keys within the system 
configuration file: 

interface, log. version The version of the Log Interface that has been implemented by the 

system. The current version is '1'. Only one version key may be 
defined at a time. 
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Appendix A: Version History 


Date 

Description 

28 Jul 2014 

Version 1, Revision 1 


Log Interface initialized and submitted for design review. 

1 Dec 2014 

Version 1, Revision 2 


Log Interface revised after second Galleon pilot. 

1 Jun 2015 

Version 1, Final 


Log Interface finalized and delivered. 
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